Incorrect authorization in podman
Priority LOW 30CWE-863Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It does not allow to directly escape the container, though being a privileged container means that a lot of security features are disabled when running the container. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Why it matters now
EPSS 0.00264 18th percentileScored 2026-11-07
Fix Partial github.com/containers/libpod (Go): 1.7.0Red Hat: 5 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | podman | podman 1.7.0 | — | No fix listed | CNA |
| — | github.com/containers/libpod (Go) | before 1.7.0 | 1.7.0 | Patch available | GHSA-9h63-7qf6-mv6r |
- podman Vendor— Affected podman 1.7.0 Fixed in — No fix listed CNA
- github.com/containers/libpod (Go) Vendor— Affected before 1.7.0 Fixed in 1.7.0 Patch available GHSA-9h63-7qf6-mv6r
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* | before 1.7.0 | Vulnerable | Podman Project |
| cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* | 3.11 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
- cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:* Versions before 1.7.0 Vulnerable ·Podman Project
- cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-9h63-7qf6-mv6r github.com/containers/libpod (Go) Fixed in 1.7.0 Advisory →
Red Hat 5 advisories
- RHSA-2021:0710 Released 2021-03-03 · Red Hat rating Importantcontainer-tools:2.0 security update
- Red Hat Enterprise Linux AppStream EUS (v. 8.2) buildah-1.11.6-7.module+el8.2.0+9938+46853747.aarch64::container-tools:2.0, buildah-1.11.6-7.module+el8.2.0+9938+46853747.ppc64le::container-tools:2.0, buildah-1.11.6-7.module+el8.2.0+9938+46853747.s390x::container-tools:2.0 +47
- RHSA-2021:0706 Released 2021-03-02 · Red Hat rating Importantcontainer-tools:2.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.aarch64::container-tools:2.0, buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.ppc64le::container-tools:2.0, buildah-1.11.6-8.module+el8.3.0+10188+4c10031c.s390x::container-tools:2.0 +47
- RHSA-2021:0705 Released 2021-03-02 · Red Hat rating Importantcontainer-tools:1.0 security update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43.aarch64::container-tools:1.0, buildah-1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43.ppc64le::container-tools:1.0, buildah-1.5-8.gite94b4f9.module+el8.3.0+10171+12421f43.s390x::container-tools:1.0 +47
Show 2 more Red Hat advisories
- RHSA-2021:0681 Released 2021-03-01 · Red Hat rating Importantpodman security update
- Red Hat Enterprise Linux 7 Extras podman-1.6.4-29.el7_9, podman-docker-1.6.4-29.el7_9
- RHSA-2020:3053 Released 2020-07-21 · Red Hat rating Moderatecontainer-tools:rhel8 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) buildah-1.14.9-1.module+el8.2.1+6689+748e6520.aarch64::container-tools:rhel8, buildah-1.14.9-1.module+el8.2.1+6689+748e6520.ppc64le::container-tools:rhel8, buildah-1.14.9-1.module+el8.2.1+6689+748e6520.s390x::container-tools:rhel8 +47
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 Extras | Fixed | RHSA-2021:0681 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:3053, RHSA-2021:0705, RHSA-2021:0706 |
| Red Hat Enterprise Linux AppStream EUS (v. 8.2) | Fixed | RHSA-2021:0710 |
Not affected: 2 products
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20188
- 2026-10-03 Alias added: GHSA-9h63-7qf6-mv6r
References
Sources
- CVE-2021-20188 · CVE Program
- CVE-2021-20188 · NVD
- FIRST EPSS
- GHSA-9h63-7qf6-mv6r · GitHub Advisory Database · CC BY 4.0
- CVE-2021-20188 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences